ServBay ships a certificate authority with your local services

The repository is documentation, not code

The first thing to understand about ServBay on GitHub is that the repository is not the product. Its top-level entries are thirteen README files, one per language, and an `images/` directory. There is no source directory, no licence file, and the language field is empty.

The READMEs cover English, Simplified and Traditional Chinese, Spanish, Arabic, Portuguese, Russian, Japanese, German, French, Vietnamese, Turkish and Italian. That much translation effort is spent on a document rather than on code, which is a reasonable thing for a binary distribution but tells you where the project actually lives.

The release history is labelled for one platform. The three most recent tags are v1.34.0, v1.34.1 and v1.34.2, each carrying the word macOS in its release name, with the newest on 2026-09-25.

So an evaluation of this project is an evaluation of a commercial product, and the GitHub page tells you what it bundles and which versions it supports. Everything about pricing, platform licensing and the code itself is somewhere else.

Eight runtimes and a per-project version lock

The language list is long enough that the interesting question is how versions are managed rather than what is included.

The bundled runtimes are PHP from 5.6 through 8.5, Node.js from 12 to 24, Python in both 2.7 and the 3.5 to 3.14 range, Go from 1.11 to 1.24, Java as OpenJDK 7 to 24, Ruby 2.4 to 3.4, Rust, and .NET from 2.0 to 10.0 alongside Mono.

Those ranges are the honest signal about what this tool is for. Python 2.7 next to 3.14 and .NET 2.0 next to 10.0 is a compatibility surface, not a currency statement: the point is that a legacy application you have to run locally will run without you installing a second machine.

The per-project mechanism is the part that changes how you work. Project-level runtime environments let you configure and lock the PHP and Node.js versions a given project needs, so two projects in the same workspace can require different versions and stay that way. Only PHP and Node.js are named as lockable.

On the database side the same inclusiveness applies: MySQL from 5.1 to 9.3, MariaDB 10.4 to 12.0, PostgreSQL 10 to 17, plus Redis, Memcached and MongoDB from 5.0 to 8.0 with MongoSH 2, all described as usable out of the box with no configuration, alongside phpMyAdmin and Adminer.

A DNS server lets you use a domain that does not exist

Domain handling is where this differs most from a plain local server stack, and the reasoning is spelled out rather than implied.

ServBay includes its own DNS server, named in the package list as dnsmasq. With it you can use non-existent domains and top-level domains without registering them, and issue SSL certificates for those names as well. The stated saving is the registration and certificate cost; the stated security benefit is that a domain which does not exist cannot be reached by an attacker who guesses it.

There is also a graphical interface for managing the hosts file, which is the other half of local name resolution and usually the part people end up editing by hand.

The web servers behind this are Caddy, Nginx and Apache, with HTTP/3 and CORS support, and custom domains with automated SSL configuration. Three servers is one more choice than most people need, and it exists because projects in the wild assume different ones.

For sharing a project without a public address, the tunnel list is ngrok, frp, Cloudflared and Pinggy, and Cloudflared is the one bundled in the package list.

You can create a certificate authority and sign your own

The PKI system is the feature that would be hardest to justify elsewhere and easiest to justify here.

You can create your own certificate authority and issue certificates from it. The stated use is small development teams that want encrypted transport and internal trust inside their own environment, and the scope is wider than web traffic: the same PKI applies to databases, to SMTP and to other services, which is where the value is. A local MySQL or a local mail server that expects TLS will not care that the certificate came from your own machine.

It also covers certificate types beyond server certificates. S/MIME certificates for email encryption, code signing certificates and PDF document signing certificates are all named, so the same authority can sign an email, a binary and a document.

Public certificates are a separate path: ACME issuance from Let's Encrypt, ZeroSSL and Google Trust Services, with automatic renewal. The two systems coexist, which means a project can be reached on a real domain with a public certificate or on a local name with one from your own authority, without changing the service configuration.

The mail server ties into the same arrangement. Mailpit handles local delivery, STARTTLS and SSL/TLS work without configuration because the PKI supplies the certificate, relaying to an external SMTP server is supported, and SpamAssassin can score outgoing mail to reduce the chance of it being flagged.

The stack is aimed at agents that need services to exist

The current framing of the product is newer than the feature list. The project describes itself as an AI-native local development tool that gives agents a real development environment so that the code can be written, running services, databases, domains, SSL and local models all on your own machine.

That claim is a repackaging decision, and the pieces underneath it were already there. Ollama is bundled for running models such as Llama 3, Mistral and Gemma locally. MinIO provides S3-compatible object storage for unstructured data, from backups and logs to media files and artefacts. Typesense and Meilisearch provide search, added to projects with one click.

What the framing adds is a reason to want all of it on one machine rather than in containers: an agent that has to provision a database, a search index and an object store through the shell needs something on the other end of those commands, and a version matrix with per-project pinning is a way to make that reliable.

It also explains the emphasis on domains and certificates, since an agent working on an HTTPS application locally needs a name and a trusted certificate to test against.

Nothing in the visible documentation describes how the agent integration itself works, which is the part to ask about.

Backups cover the environment, not only the data

The backup scope is wider than the word usually implies, and it is the feature that matters most when something goes wrong.

Backups can be scheduled or triggered manually, and they cover databases, website files, service configurations and SSL certificates. Restoring takes the environment back to a previous state, and the same backups are described as the mechanism for migrating an entire ServBay setup to a new machine.

Including service configurations and certificates is what makes the migration claim work. A database dump alone leaves you reinstalling every service and reissuing certificates; a full environment backup carries the settings that make the stack reproducible on the other machine.

For a tool that installs fixed versions of eight runtimes and six databases on your system, that difference is the difference between a fifteen-minute recovery and a day of reinstallation.

The multi-site management feature sits alongside this: each site has its own settings, domain and environment, and the interface is meant to make switching between them cheap, which is also what makes a per-site restore meaningful.

Editorial conclusion

Adopt ServBay if you want a local stack with per-project runtime versions, a DNS server that lets you test on domains you do not own, and a private certificate authority for services that need TLS between them. Do not expect an open source project here: the GitHub repository holds thirteen README files and an images directory, no source and no recorded licence, and the releases are labelled for macOS. Verify two things before committing. Check the terms on the vendor's own site, since the licence is not in the repository. Then confirm your runtime versions are in range, because the bundled matrix spans PHP 5.6 to 8.5 and Python 2.7 alongside 3.14, which tells you what it is built to be compatible with rather than current.

Frequently asked questions

Official sources

1. Issues
2. Project website
3. README
4. Releases
5. ServBay/ServBay on GitHub